Description

Detects insecure temporary file creation in Go code that could enable race condition attacks or unauthorized file access. When temporary files are created with predictable names or unsafe permissions, attackers may be able to hijack file operations or access sensitive data.

Detection Strategy

• Identifies calls to temporary file creation functions from the os, io/ioutil, or path/filepath packages

• Detects file operations that use create flags or non-OpenFile operations

• Checks if the file path argument uses unsafe or predictable paths rather than secure temporary file creation methods

• Reports issues when file operations don't use secure temporary file creation functions like ioutil.TempFile

Vulnerable code example

package main

import (
    "os"
    "path/filepath"
)

func main() {...

✅ Secure code example

package main

import (
    "os"
    "path/filepath"
)

func main() {...